eg1xbet[.]com

This domain is currently under investigation for hosting a phishing campaign impersonating the 1xBet online betting platform. Analysis indicates the site is designed to harvest user credentials through fraudulent login interfaces, a common tactic in brand impersonation schemes targeting financial and gambling sectors. Infrastructure analysis reveals the domain eg1xbet.com was registered on August 09, 2023, through URL SOLUTIONS INC, a registrar frequently associated with malicious domains. It resolves to the IP address 83.147.204.246 and remains active despite being flagged by one security blocklist. VirusTotal reports 0 out of 95 detections, suggesting the campaign may still be evading widespread detection. The domain appears in 50 threat intelligence pulses on AlienVault OTX, indicating prior identification in phishing-related activities. The SSL certificate is issued by Let's Encrypt, and detected technologies include C, Perl, Angie, and HSTS, which may be leveraged to enhance the site's perceived legitimacy. Mitigation steps for this specific threat type include blocking the domain and its resolving IP at the network perimeter. Organizations should update endpoint protection rules to flag eg1xbet.com and related indicators, particularly in sectors where 1xBet is a known brand. Users should be educated to verify domain authenticity before entering credentials, especially on platforms offering financial transactions. Monitoring for additional domains registered through URL SOLUTIONS INC with similar naming patterns (e.g., typosquatting variations of 1xBet) is recommended to preempt further campaigns.